CVE-2026-84316

Received Received - Intake

Authenticated Code Execution via Config Directive Bypass in Nginx UI

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: GitHub, Inc.

Description

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller can place a benign directive first and a restricted load_module, js_import, perl, or user root directive later on the same line, or can use an unrestricted include directive to load restricted content. These mechanisms bypass validation on REST, nginx_config_modify, site, and stream write paths; when an executable module is available, the injected configuration can execute code in the Nginx worker context. This issue is fixed in version 2.4.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-84316

Affected Vendors & Products

Vendor	Product	Version / Range
0xJacky	nginx-ui	< 2.4.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-184	The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

Executive Summary

Nginx UI before 2.4.1 has a validation flaw where config.ValidateConfigDirectives splits configuration by newline and only checks the first directive token per line. Nginx allows multiple semicolon-separated directives on one line, so an attacker can bypass validation by placing a benign directive first and a restricted directive later on the same line. This allows loading restricted modules or executing code in the Nginx worker context.

Detection Guidance

Check the version of Nginx UI installed on your system. If it is below 2.4.1, the system is vulnerable. Run: nginx-ui --version or check the package manager for installed versions.

Impact Analysis

An authenticated attacker could exploit this to execute arbitrary code in the Nginx worker context by injecting malicious configuration directives. This could lead to full system compromise, data theft, or disruption of services if the attacker gains control over the Nginx process.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating data confidentiality and integrity requirements in GDPR and HIPAA. A successful exploit may result in unauthorized access to sensitive data, triggering compliance violations and legal penalties.

Mitigation Strategies

Upgrade Nginx UI to version 2.4.1 or later immediately. Remove or restrict access for unauthenticated users to the Nginx UI interface. Review configuration files for suspicious directives like load_module, js_import, perl, or user root.

Hi! I’m here to help you understand CVE-2026-84316. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70